On Wed, 6 Feb 2013, John P. Rouillard wrote:
> You may want to create a rule the fires only once on startup and
> populates a number of action variables rather than putting the evals
> into an action rule that will fire on every use unless you are somehow
> changing the environment on the fly.
>
> type= single
> desc= map environment vars to action vars
> ptype= regexp
> pattern= ^SEC_STARTUP$
> context= SEC_INTERNAL_EVENT
> action= eval %SECLOG ($main::ENV{'SEC_LOG'}); \
> eval ....
>
> I the pattern is correct if you use sec --intevents IIRC.
Even if the values do change occasionally, you are probably better off setting
them at startup, then re-checking them (either based of calendar rules or when
a
'reload values' pattern shows up in a log message) rather than evaluating them
each time they are used.
David Lang
------------------------------------------------------------------------------
Free Next-Gen Firewall Hardware Offer
Buy your Sophos next-gen firewall before the end March 2013
and get the hardware for free! Learn more.
http://p.sf.net/sfu/sophos-d2d-feb
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
